.deploy-infra/deploy-dev.yaml

@@ -5,46 +5,20 @@ services:
   nginx:
     image: mathwave/sprint-repo:sprint-infra-nginx-dev
     networks:
-      - common-infra-nginx-development
+      - common-infra-nginx
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
-      - published: 80
+      - "80:80"
-        target: 80
+      - "443:443"
-        mode: host
-      - published: 443
-        target: 443
-        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
-      update_config:
-        parallelism: 1
-        # order: stop-first
-  
-  clickhouse:
-    image: clickhouse
-    networks:
-      - clickhouse-development
-      - common-infra-nginx-development
-    volumes:
-      - /sprint-data/clickhouse:/var/lib/clickhouse
-    environment:
-      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_DEV
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
+        order: start-first
 
   postgres:
     image: postgres:14-alpine3.19
@@ -59,15 +33,13 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - published: 5432
+      - "5432:5432"
-        target: 5432
-        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first
@@ -80,15 +52,13 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_DEV
     ports:
-      - published: 27017
+      - "27017:27017"
-        target: 27017
-        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first 
@@ -98,12 +68,8 @@ services:
     volumes:
       - /sprint-data/rabbitmq:/var/lib/rabbitmq
     ports:
-      - published: 5672
+      - "5672:5672"
-        target: 5672
+      - "15672:15672"
-        mode: host
-      - published: 15672
-        target: 15672
-        mode: host
     environment:
       RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
     deploy:
@@ -111,7 +77,7 @@ services:
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first
@@ -121,16 +87,14 @@ services:
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - published: 6379
+      - "6379:6379"
-        target: 6379
-        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_DEV
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first
@@ -143,16 +107,12 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_DEV
     ports:
-      - published: 9000
+      - "9000:9000"
-        target: 9000
+      - "9001:9001"
-        mode: host
-      - published: 9001
-        target: 9001
-        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       restart_policy:
         condition: any
       update_config:
@@ -172,7 +132,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.labels.stage == development]
+        constraints: [node.role == manager]
       restart_policy:
         condition: any
       update_config:
@@ -184,9 +144,7 @@ volumes:
     driver: local
 
 networks:
-  common-infra-nginx-development:
+  net:
-    external: true
+    driver: overlay
-  configurator:
+  common-infra-nginx:
-    external: true
-  clickhouse-development:
     external: true

.deploy-infra/deploy-prod.yaml

@@ -6,125 +6,19 @@ services:
     image: mathwave/sprint-repo:sprint-infra-nginx-prod
     networks:
       - common-infra-nginx
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
     ports:
-      - published: 80
+      - "80:80"
-        target: 80
+      - "443:443"
-        mode: host
-      - published: 443
-        target: 443
-        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
-        # order: start-first
+        order: start-first
-  
-  zitadel:
-    image: ghcr.io/zitadel/zitadel:latest
-    networks:
-      - common-infra-nginx
-    command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
-    environment:
-      ZITADEL_DATABASE_POSTGRES_HOST: pg.sprinthub.ru
-      ZITADEL_DATABASE_POSTGRES_PORT: 5432
-      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
-      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: postgres
-      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: $DB_PASSWORD_PROD
-      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
-      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
-      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: $DB_PASSWORD_PROD
-      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
-      ZITADEL_EXTERNALSECURE: "false"
-      ZITADEL_EXTERNALDOMAIN: zitadel.chocomarsh.com
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      update_config:
-        parallelism: 1
-    
-  # authelia:
-  #   image: mathwave/sprint-repo:authelia
-  #   networks:
-  #     - common-infra-nginx
-  #   environment:
-  #     AUTHELIA_JWT_SECRET: $AUTHTHELIA_JWT_SECRET
-  #     AUTHELIA_SESSION_SECRET: $AUTHTHELIA_SESSION_SECRET
-  #     AUTHELIA_STORAGE_ENCRYPTION_KEY: $AUTHELIA_STORAGE_ENCRYPTION_KEY
-  #     AUTHELIA_STORAGE_POSTGRES_PORT: "5432"
-  #     AUTHELIA_STORAGE_POSTGRES_DATABASE: "authelia"
-  #     AUTHELIA_STORAGE_POSTGRES_USERNAME: "postgres"
-  #     AUTHELIA_STORAGE_POSTGRES_PASSWORD: $DB_PASSWORD_PROD
-  #     AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY: "one_factor"
-  #     AUTHELIA_NOTIFIER_SMTP_ENABLED: "false"
-  #   volumes:
-  #     - /sprint-data/authelia/data:/var/lib/authelia
-  #   deploy:
-  #     mode: replicated
-  #     replicas: 1
-  #     restart_policy:
-  #       condition: any
-  #     placement:
-  #       constraints: [node.labels.stage == production]
-  #     update_config:
-  #       parallelism: 1
-
-  grafana:
-    image: grafana/grafana
-    networks:
-      - common-infra-nginx
-      - clickhouse
-    volumes:
-      - /sprint-data/grafana:/var/lib/grafana
-    environment:
-      GF_SERVER_ROOT_URL: https://grafana.chocomarsh.com
-      GF_CORS_ENABLED: "false"
-      GF_AUTH_DISABLE_LOGIN_FORM: "false"
-      GF_CORS_ALLOW_ORIGINS: "*"
-      GF_SECURITY_CONTENT_SECURITY_POLICY: "false"
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == production]
-      update_config:
-        parallelism: 1
-
-  clickhouse:
-    image: clickhouse
-    networks:
-      - clickhouse
-    volumes:
-      - /sprint-data/clickhouse:/var/lib/clickhouse
-    environment:
-      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_PROD
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == production]
-      update_config:
-        parallelism: 1
-      resources:
-        limits:
-          memory: 2048M
-          cpus: '2.0'
-        reservations:
-          memory: 1024M
-          cpus: '1.0'
 
   postgres:
     image: postgres:14-alpine3.19
@@ -139,15 +33,13 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - published: 5432
+      - "5432:5432"
-        target: 5432
-        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first
@@ -165,34 +57,49 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_PROD
     ports:
-      - published: 27017
+      - "27017:27017"
-        target: 27017
-        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first 
 
+  rabbitmq:
+    image: rabbitmq:3.10.7-management
+    volumes:
+      - /sprint-data/rabbitmq:/var/lib/rabbitmq
+    ports:
+      - "5672:5672"
+      - "15672:15672"
+    environment:
+      RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
+    deploy:
+      mode: replicated
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.role == manager]
+      update_config:
+        parallelism: 1
+        order: start-first
+
   redis:
     image: redis:alpine3.16
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - published: 6379
+      - "6379:6379"
-        target: 6379
-        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_PROD
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first
@@ -205,16 +112,12 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_PROD
     ports:
-      - published: 9000
+      - "9000:9000"
-        target: 9000
+      - "9001:9001"
-        mode: host
-      - published: 9001
-        target: 9001
-        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       restart_policy:
         condition: any
       update_config:
@@ -241,7 +144,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       restart_policy:
         condition: any
       update_config:
@@ -261,7 +164,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
       restart_policy:
         condition: any
       update_config:
@@ -278,8 +181,4 @@ networks:
   net:
     driver: overlay
   common-infra-nginx:
-    external: true
+    external: true
-  configurator:
-    external: true
-  clickhouse:
-    external: true

.deploy-nginx/deploy-dev.yaml

@@ -1,34 +0,0 @@
-version: "3.6"
-
-services:
-
-  nginx:
-    image: mathwave/sprint-repo:sprint-infra-nginx-dev
-    networks:
-      - common-infra-nginx-development
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
-    ports:
-      - published: 80
-        target: 80
-        mode: host
-      - published: 443
-        target: 443
-        mode: host
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == development]
-      update_config:
-        parallelism: 1
-        # order: stop-first
-
-networks:
-  common-infra-nginx-development:
-    external: true
-  configurator:
-    external: true

.deploy-nginx/deploy-prod.yaml

@@ -1,34 +0,0 @@
-version: "3.6"
-
-services:
-
-  nginx:
-    image: mathwave/sprint-repo:sprint-infra-nginx-prod
-    networks:
-      - common-infra-nginx
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
-    ports:
-      - published: 80
-        target: 80
-        mode: host
-      - published: 443
-        target: 443
-        mode: host
-    deploy:
-      mode: replicated
-      replicas: 1
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == production]
-      update_config:
-        parallelism: 1
-        # order: start-first
-
-networks:
-  common-infra-nginx:
-    external: true
-  configurator:
-    external: true

.deploy-portainer/deploy-dev.yaml

@@ -0,0 +1,39 @@
+version: '3.2'
+
+services:
+  agent:
+    image: portainer/agent:2.11.1
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/lib/docker/volumes:/var/lib/docker/volumes
+    networks:
+      - agent_network
+    deploy:
+      mode: global
+      placement:
+        constraints: [node.platform.os == linux]
+
+  portainer:
+    image: portainer/portainer-ce:2.11.1
+    command: -H tcp://tasks.agent:9001 --tlsskipverify
+    ports:
+      - "9443:9443"
+      - "8888:9000"
+      - "8000:8000"
+    volumes:
+      - portainer_data:/data
+    networks:
+      - agent_network
+    deploy:
+      mode: replicated
+      replicas: 1
+      placement:
+        constraints: [node.role == manager]
+
+networks:
+  agent_network:
+    driver: overlay
+    attachable: true
+
+volumes:
+  portainer_data:

.deploy-portainer/deploy-prod.yaml

@@ -28,7 +28,7 @@ services:
       mode: replicated
       replicas: 1
       placement:
-        constraints: [node.labels.stage == production]
+        constraints: [node.role == manager]
 
 networks:
   agent_network:

.deploy-swarmpit/deploy-dev.yaml

@@ -0,0 +1,83 @@
+version: '3.3'
+
+services:
+  app:
+    image: swarmpit/swarmpit:latest
+    environment:
+      - SWARMPIT_DB=http://db:5984
+      - SWARMPIT_INFLUXDB=http://influxdb:8086
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+    networks:
+      - net
+    ports:
+      - "888:8080"
+    deploy:
+      resources:
+        limits:
+          memory: 1024M
+        reservations:
+          memory: 512M
+      placement:
+        constraints:
+          - node.role == manager
+  db:
+    image: treehouses/couchdb:2.3.1
+    volumes:
+      - db-data:/opt/couchdb/data
+    networks:
+      - net
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+        reservations:
+          memory: 128M
+
+  influxdb:
+    image: influxdb:1.7
+    volumes:
+      - influx-data:/var/lib/influxdb
+    networks:
+      - net
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+        reservations:
+          memory: 128M
+
+  agent:
+    image: swarmpit/agent:latest
+    environment:
+      - DOCKER_API_VERSION=1.35
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - net
+    deploy:
+      mode: global
+      labels:
+        swarmpit.agent: 'true'
+      resources:
+        limits:
+          memory: 64M
+        reservations:
+          memory: 32M
+
+networks:
+  net:
+    driver: overlay
+  swarmpit-nginx:
+    external: true
+
+volumes:
+  db-data:
+    driver: local
+  influx-data:
+    driver: local

.deploy-swarmpit/deploy-prod.yaml

@@ -24,10 +24,12 @@ services:
         reservations:
           memory: 512M
       placement:
-        constraints: [node.labels.stage == production]
+        constraints:
-
+          - node.role == manager
   db:
     image: treehouses/couchdb:2.3.1
+    volumes:
+      - db-data:/opt/couchdb/data
     networks:
       - net
     deploy:
@@ -39,6 +41,8 @@ services:
 
   influxdb:
     image: influxdb:1.7
+    volumes:
+      - influx-data:/var/lib/influxdb
     networks:
       - net
     deploy:
@@ -69,3 +73,11 @@ services:
 networks:
   net:
     driver: overlay
+  swarmpit-nginx:
+    external: true
+
+volumes:
+  db-data:
+    driver: local
+  influx-data:
+    driver: local

.gitea/workflows/deploy-dev.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ prod ]
+    runs-on: [ dev ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -23,15 +23,15 @@ jobs:
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
-    runs-on: [ prod ]
+    runs-on: [ dev ]
     needs: build
     steps:
       - name: push nginx dev
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-dev
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
-  prepare:
+  deploy-dev:
-    name: prepare
+    name: Deploy dev
     runs-on: [dev]
     needs: push
     steps:
@@ -41,27 +41,16 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: dev
-      - name: prepare
+      - name: deploy swarmpit
-        run: chmod 777 ./prepare/run-development.sh && ./prepare/run-development.sh
+        run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-dev.yaml swarmpit
-  deploy-dev:
+      - name: deploy portainer
-    name: Deploy dev
+        run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-dev.yaml portainer
-    runs-on: [prod]
-    needs: prepare
-    steps:
-      - name: login
-        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
-      - name: checkout
-        uses: actions/checkout@v4
-        with:
-          ref: dev
       - name: deploy infra
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
           DB_PASSWORD_DEV: ${{ secrets.POSTGRES_PASSWORD_DEV }}
-          CLICKHOUSE_PASSWORD_DEV: ${{ secrets.CLICKHOUSE_PASSWORD_DEV }}
           MINIO_PASSWORD_DEV: ${{ secrets.MINIO_PASSWORD_DEV }}
-          MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
           REDIS_PASSWORD_DEV: ${{ secrets.REDIS_PASSWORD_DEV }}
           RABBITMQ_PASSWORD_DEV: ${{ secrets.RABBITMQ_PASSWORD_DEV }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
-        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra-development
+        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra

.gitea/workflows/deploy-prod.yaml

@@ -9,44 +9,27 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ prod ]
+    runs-on: [ dev ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: checkout
         uses: actions/checkout@v4
         with:
-          ref: prod
+          ref: dev
       - name: build nginx prod
         run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-prod nginx/nginx-prod
       - name: build gitea runner
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
-      - name: build authelia
-        run: docker build -t mathwave/sprint-repo:authelia authelia
   push:
     name: Push
-    runs-on: [ prod ]
+    runs-on: [ dev ]
     needs: build
     steps:
       - name: push nginx prod
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-prod
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
-      - name: push authelia
-        run: docker push mathwave/sprint-repo:authelia
-  prepare:
-    name: prepare
-    runs-on: [prod]
-    needs: push
-    steps:
-      - name: login
-        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
-      - name: checkout
-        uses: actions/checkout@v4
-        with:
-          ref: prod
-      - name: prepare
-        run: chmod 777 ./prepare/run-production.sh && ./prepare/run-production.sh
   deploy-prod:
     name: Deploy prod
     runs-on: [prod]
@@ -66,13 +49,8 @@ jobs:
         env:
           MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
           DB_PASSWORD_PROD: ${{ secrets.POSTGRES_PASSWORD_PROD }}
-          CLICKHOUSE_PASSWORD_PROD: ${{ secrets.CLICKHOUSE_PASSWORD_PROD }}
           MINIO_PASSWORD_PROD: ${{ secrets.MINIO_PASSWORD_PROD }}
-          MINIO_SECRET_KEY_PROD: ${{ secrets.MINIO_SECRET_KEY_PROD }}
           REDIS_PASSWORD_PROD: ${{ secrets.REDIS_PASSWORD_PROD }}
           RABBITMQ_PASSWORD_PROD: ${{ secrets.RABBITMQ_PASSWORD_PROD }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
-          AUTHTHELIA_JWT_SECRET: ${{ secrets.AUTHTHELIA_JWT_SECRET }}
-          AUTHTHELIA_SESSION_SECRET: ${{ secrets.AUTHTHELIA_SESSION_SECRET }}
-          AUTHELIA_STORAGE_ENCRYPTION_KEY: ${{ secrets.AUTHELIA_STORAGE_ENCRYPTION_KEY }}
         run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-prod.yaml infra

authelia/Dockerfile

@@ -1,3 +0,0 @@
-FROM authelia/authelia
-COPY configuration.yml /config/configuration.yml
-COPY users.yml /config/users.yml

authelia/configuration.yml

@@ -1,44 +0,0 @@
-theme: dark
-
-jwt_secret: secret-jwt-will-be-overridden-by-env
-
-server:
-  host: 0.0.0.0
-  port: 9091
-
-log:
-  level: info
-
-authentication_backend:
-  file:
-    path: /config/users.yml
-
-access_control:
-  default_policy: one_factor
-  rules:
-    - domain: "*.chocomarsh.com"
-      policy: one_factor
-
-session:
-  name: authelia_session
-  expiration: 1h
-  inactivity: 5m
-  remember_me_duration: 1w
-  cookies:
-    - domain: chocomarsh.com
-      authelia_url: https://auth.chocomarsh.com
-      default_redirection_url: https://login.chocomarsh.com
-
-storage:
-  encryption_key: "a_very_long_secret_32_characters_minimum"
-  postgres:
-    host: pg.sprinthub.ru
-    port: 5432
-    database: authelia
-    schema: public
-    username: postgres
-    password: autheliapass  # also override with env if preferred
-
-notifier:
-  filesystem:
-    filename: /config/notification.txt

authelia/users.yml

@@ -1,5 +0,0 @@
-users:
-  emmatveev:
-    password: "$argon2id$v=19$m=65536,t=1,p=4$CixMXaAilVof3yk1rtghwg$V/kcl1HNDWeybrV3SrVjjdI00D1lFtuvLldkwAklSOE"
-    displayname: "Egor Matveev"
-    email: emmtvv@gmail.com

gitlab-runner/Dockerfile

@@ -0,0 +1,14 @@
+FROM gitlab/gitlab-runner
+
+
+RUN apt-get update
+RUN apt-get install --yes ca-certificates curl gnupg lsb-release
+RUN mkdir -p /etc/apt/keyrings
+RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+RUN echo \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+  $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+RUN apt-get update --yes
+RUN apt-get install --yes docker-ce docker-ce-cli containerd.io docker-compose-plugin
+RUN mkdir /etc/builds/
+RUN chmod 777 /etc/builds

nginx/nginx-dev/Dockerfile

@@ -1,13 +1,4 @@
 FROM nginx
-RUN apt-get update
-RUN apt-get install certbot --yes
-RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
-COPY prepare.py prepare.py
+COPY ./privkey.pem /etc/nginx/privkey.pem
-COPY run.sh run.sh
+COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY refre.sh refre.sh
-ENV PYTHONUNBUFFERED=1
-RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
-ENTRYPOINT ["./run.sh"]

nginx/nginx-dev/config/guavo.conf

@@ -0,0 +1,162 @@
+
+    # server {
+    #     listen 80;
+    #     server_name *.develop.guavo.tech;
+    #     return 301 https://$host$request_uri;
+    # }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name swarmpit.develop.guavo.tech;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.guavo.tech:888/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name portainer.develop.guavo.tech;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.guavo.tech:8888/;
+        }
+
+        location /api/websocket/ {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://develop.guavo.tech:8888/api/websocket/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name rabbitmq.develop.guavo.tech;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.guavo.tech:15672/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name minio.develop.guavo.tech;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.guavo.tech:9001/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name grafana.develop.guavo.tech;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        proxy_set_header Host $http_host;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.guavo.tech:3000/;
+        }
+
+        location /api/live/ws {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://develop.guavo.tech:3000/api/live/ws;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
+
+        resolver 127.0.0.11 ipv6=off;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header        X-Real-IP       $remote_addr;
+
+        location / {
+            proxy_pass http://$domain-nginx:1238$request_uri;
+        }
+    }
+
+    server {
+        listen      80;
+        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
+
+        resolver 127.0.0.11 ipv6=off;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header        X-Real-IP       $remote_addr;
+
+        location / {
+            proxy_pass http://$domain-nginx:1238$request_uri;
+        }
+    }

nginx/nginx-dev/config/nginx.conf

@@ -7,18 +7,7 @@ http {
         default upgrade;
         '' close;
     }
-
-    server {
-        listen 80;
-        server_name *.develop.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.dev.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
     
-    include ./hosts.conf;
+    include ./guavo.conf;
+    include ./sprinthub.conf;
 }

nginx/nginx-dev/config/sprinthub.conf

@@ -0,0 +1,143 @@
+
+    server {
+        listen 80;
+        server_name *.develop.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name swarmpit.develop.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.sprinthub.ru:888/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name portainer.develop.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.sprinthub.ru:8888/;
+        }
+
+        location /api/websocket/ {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://develop.sprinthub.ru:8888/api/websocket/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name rabbitmq.develop.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.sprinthub.ru:15672/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name minio.develop.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.sprinthub.ru:9001/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name grafana.develop.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        proxy_set_header Host $http_host;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://develop.sprinthub.ru:3000/;
+        }
+
+        location /api/live/ws {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://develop.sprinthub.ru:3000/api/live/ws;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name ~^(?<domain>.*)\.develop\.sprinthub\.ru$;
+
+        resolver 127.0.0.11 ipv6=off;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header        X-Real-IP       $remote_addr;
+
+        location / {
+            proxy_pass http://$domain-nginx:1238$request_uri;
+        }
+    }
+

nginx/nginx-dev/fullchain.pem

@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIE+zCCA+OgAwIBAgISA1gLQJEHOf44GcYLUSr2vDoDMA0GCSqGSIb3DQEBCwUA
+MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
+EwNSMTEwHhcNMjQwODE4MTcwNTE0WhcNMjQxMTE2MTcwNTEzWjAhMR8wHQYDVQQD
+DBYqLmRldmVsb3Auc3ByaW50aHViLnJ1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAu5dE0JYsLqqYrqulQkDeApuAPp5ckTFbg72UhSrfo2SbbP0S2//P
+75hvn4aUAsPPWsUk8PDYQn8tOd0/1TrLMmh8xhJxTUUcO3fgP0mbgiYsQep/z5LU
+BgzGC5R2zQhl4O+SdYlCC56zz1GHNK+IWhXgaLz0dnaKXEIpsVnu2r9THEFAoXRx
+j2J64WwdDSC63Qqs2juvMsU9zizYpOnQr6wxIYNIe+jnUJoGeg84gYz7RMzmEYQh
+9Ut36apABFt7vyo9YXKPA7X9GLGHiWBkisxhtXhyg27aHwYF8E9+C98qczbbBenG
+CqFcfAlYNaje8a1yOan/zFUWShOqDVS8gQIDAQABo4ICGTCCAhUwDgYDVR0PAQH/
+BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
+AjAAMB0GA1UdDgQWBBSYER0/itBzQ4e89Jz45eNBs2IHtDAfBgNVHSMEGDAWgBTF
+z0ak6vTDwHpslcQtsF6SLybjuTBXBggrBgEFBQcBAQRLMEkwIgYIKwYBBQUHMAGG
+Fmh0dHA6Ly9yMTEuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTEu
+aS5sZW5jci5vcmcvMCEGA1UdEQQaMBiCFiouZGV2ZWxvcC5zcHJpbnRodWIucnUw
+EwYDVR0gBAwwCjAIBgZngQwBAgEwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgAZ
+mBBxCfDWUi4wgNKeP2S7g24ozPkPUo7u385KPxa0ygAAAZFmqM41AAAEAwBHMEUC
+ICafD/B6cYgX6M7zYU0SaMx8mfJZiqvuGWGU15Xk+1ntAiEA86dLxeYXXRVDXU56
+4+fgStSswCsjvaHvzX2nND1f95EAdQB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIK
+n+ZnTFo6dAAAAZFmqM59AAAEAwBGMEQCIB/YExYTmuWxHl2kxLy+NO3txOaobvIZ
+pxkV69p4Yrg6AiB0PGckYcU3+eqiTyPKV21T/tXu2Sl6FTGn14991RqCxjANBgkq
+hkiG9w0BAQsFAAOCAQEAVdTUq5zdSfk7060jhQ5KeIzOjsX/A59psnT3YD+5SSJ+
+K4NFSG2MYGt32W+CcEglCF9PiPAq0++61TL9KTAlREwmReRRvhhwd6tHd/2hL9FN
+bIy34fXtd173FiFs2cmq70bChyNlnZHdgMEccfuqoamuwFnySqFFeUIPC36eD0XD
++5FBgleiaEM2OL8ZelGj7wil4I8a5XT7U/Kzl3HXy94mHXHqf4d0tiJnAsrLhfvy
+Yl+5gXOMXvL5qZdQC0FR9mVQQF9oClRxsdDp681cJIM63b2KazEN1NhJP/rfn1ZO
+v9QdRNWZEIEp8dvYDoNNxwy5ibUcvdGOV1Mm0NVORQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
+DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
+AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
+6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
+SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
+Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
+hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
+/wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
+ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
+hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
+A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
+AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
+v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
+01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
+e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
+UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
+aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
+WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
+PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
+pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
+6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
+uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
+-----END CERTIFICATE-----

nginx/nginx-dev/prepare.py

@@ -1,85 +0,0 @@
-import os
-import sys
-from minio import Minio
-from urllib.request import urlopen
-from json import loads
-
-
-minio_client = Minio(
-    "minio.develop.sprinthub.ru:9000",
-    access_key="serviceminioadmin",
-    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
-)
-
-
-def get(url):
-    with urlopen(url) as response:
-        data = response.read().decode("utf-8")
-        return loads(data)
-
-
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=development"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
-
-config = ""
-for host, params in hosts.items():
-    config += """
-        server {{
-            listen      443 ssl http2;
-            listen      [::]:443 ssl http2;
-            server_name {host};
-
-            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
-            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
-
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            location / {{
-                resolver 127.0.0.11;
-                proxy_pass http://{target_host}:{port}$request_uri;
-            }}
-        }}\n\n
-    """.format(
-        host=host, target_host=params["host"], port=params["port"]
-    )
-    try:
-        fullchain = minio_client.get_object(
-            "certupdater", f"certificates/{host}/fullchain.pem"
-        )
-        privkey = minio_client.get_object(
-            "certupdater", f"certificates/{host}/privkey.pem"
-        )
-        try:
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
-
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
-            fp.write(fullchain.data)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-            fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
-
-try:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
-        fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)

nginx/nginx-dev/privkey.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC7l0TQliwuqpiu
+q6VCQN4Cm4A+nlyRMVuDvZSFKt+jZJts/RLb/8/vmG+fhpQCw89axSTw8NhCfy05
+3T/VOssyaHzGEnFNRRw7d+A/SZuCJixB6n/PktQGDMYLlHbNCGXg75J1iUILnrPP
+UYc0r4haFeBovPR2dopcQimxWe7av1McQUChdHGPYnrhbB0NILrdCqzaO68yxT3O
+LNik6dCvrDEhg0h76OdQmgZ6DziBjPtEzOYRhCH1S3fpqkAEW3u/Kj1hco8Dtf0Y
+sYeJYGSKzGG1eHKDbtofBgXwT34L3ypzNtsF6cYKoVx8CVg1qN7xrXI5qf/MVRZK
+E6oNVLyBAgMBAAECggEBAKEV26TWX+hO3D+Z65ZCB6Lrjyu2ZzzSyogNQr07vMEd
+Qo5Ln2dFe3R+TNQLB4x8QtHqWrd/yeUIOnjm8cqT6ytFKGgaLCszPnQek3UlKyGO
+0BBmYwyHRARR8bq96WpVXM7USssda5Z42GUd2GG4nfjlskeegro7PsLMmerOlFpH
+2aYY/KTb6M45qSwZboFvg+s6bGFXjYafZ+Mktj+iJBLuNvxI0Hj6R5aX8XB3Ef68
+BiZA12z/jnzERm9zRiLmnGK0xdSRXVyNbeDcP4f8qlqk5N5ga0yxnJpEyTYzfGXy
+820TwpFh8G2AKdanbhAGKtI2vGPpO146dUaJdhYGxGUCgYEA66h58ttJKrAR0AP5
++pU0yLo5myOBuRoBDn1k5+ppExqPi1bOQSebnkRRLpWuY1NfanFr3nbDjMi2FI8P
+VYTf5AECQQvvwXrbsRl0mFBlL4Q8r4yxTLTUBOvEQX63SyYvUwbsmYQSFuIOvr5L
+BV31UMR5CEuBGCCYUm6kZV6HeJsCgYEAy8ic9qwDxoYSdq5J9dbqtPjn5cIwpLhd
+o/0OJrkEptU8oIDyey/X5vlDV/FLfdsChjiMFjY661tOgXuTvDGTDzI51U6meKk7
+ogLpuURFVJIvWhPBilL+HvPY/oiZjmRyGgvlvpDPjAsWo155WqMrWPh4lfhXjY3z
+p5lofNB6axMCgYEAyjTT/ujeTTyq7BydYMCqfBoe19mNs/B2O6Ko9L6UzomZ5evk
+Ks/7nb/tENXqvtuJIeKUtlydyq1mXxmqBK1xF0kuT/YYEaKD4+B9xTwmtrD3CYLl
+l3YJ/vb2fWRnjpoDPXDRj6BdjTkHge/ym3ZVyqnrWIzBBpzhVsoNUdXc1EUCgYEA
+wniKQmTZnYSo7hVZg4A7r8SxGPP+k9NVmX+PF6kNJWDtYIZt4N1Bfqx1deFRl6N/
+fzNLjI7oH16dRrf1vmzY2HGn+0X5W8C0peF9xk2+k/yFr8KWujiFRmiStiUJ1XdJ
+5E1iTD/JsO2MBw/LY5G/dkJ4YTYD55SF53Vg32vcx30CgYEAog3coA0caJ8uAA5K
+UzcQ/vlX5twEt/DRBnrBbGtV/x4y36hRucahIDyTLEyCA9G0TFgQKMEUdUVkoLvQ
+cgtLLq340NYN+jFdpFDwAVSBi2Z3NVyh2rX5Q2saYzpOxVaaEe06dOC8Bl6le1EC
+cLTZ2YqFcCrRLrzy/hhKO7HImt4=
+-----END PRIVATE KEY-----

nginx/nginx-dev/refre.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if ! python3 prepare.py; then
-    echo "Error running prepare.py" >&2
-    exit 1
-fi
-
-if ! nginx -s reload; then
-    echo "Error reloading nginx" >&2
-    exit 1
-fi

nginx/nginx-dev/run.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-/docker-entrypoint.sh nginx -g 'daemon off;'

nginx/nginx-prod/Dockerfile

@@ -1,13 +1,10 @@
 FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
-RUN apt-get install python3-certbot-nginx python3-pip --yes
+RUN apt-get install python3-certbot-nginx --yes
-RUN pip3 install --break-system-packages minio
+RUN mkdir /etc/allinvest
-COPY ./config /etc/nginx
+COPY ./nginx-prod.conf /etc/nginx/nginx.conf
-COPY prepare.py prepare.py
+COPY ./privkey.pem /etc/nginx/privkey.pem
-COPY run.sh run.sh
+COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY refre.sh refre.sh
+COPY ./allinvest/privkey.pem /etc/allinvest/privkey.pem
-ENV PYTHONUNBUFFERED=1
+COPY ./allinvest/fullchain.pem /etc/allinvest/fullchain.pem
-RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
-ENTRYPOINT ["./run.sh"]

nginx/nginx-prod/allinvest/fullchain.pem

@@ -0,0 +1,90 @@
+-----BEGIN CERTIFICATE-----
+MIIE5TCCA82gAwIBAgISBLLA45sg/IhDBwA/vxe7YIKrMA0GCSqGSIb3DQEBCwUA
+MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
+EwJSMzAeFw0yNDAyMDMyMTI1NDdaFw0yNDA1MDMyMTI1NDZaMBcxFTATBgNVBAMT
+DHlvdXJnb2xzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANFC
+SqAyzSV1BHFSqKxH3GuLEVRgxUABAhveeLWOTJt3xrKTNhdgaP4fD8CZF5vmgFqx
+M/Zk4mizZ9FEQeKnrmlhAL643OaGRTVwN1FfBEfvr/fT3AQD0HQB55OSsUReSFUn
+yT9vR2cv+r/f6EU78Uw/svvTD7M0vY/uRfOc2qWv+I6dGsoS32iDQmsYlOK4HKWX
+mfBTuGSCJKcec1nviehXXrGFP4YJa3gs6RzWTtGXxGgI0lG9O366RszkKZKVJICh
+BH+YWV9KJ1hzgmRWlRJgs4t14MO2Dxw5Mu1G08WbaEQGvE7RgcBCNY8sV1K1Bx/P
+NUPRsSPT6rIsX3MhQ4sCAwEAAaOCAg4wggIKMA4GA1UdDwEB/wQEAwIFoDAdBgNV
+HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
+FgQUcY+9gyWVjqP8S2owFnPbtwbiZ1QwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA
+5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu
+by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w
+FwYDVR0RBBAwDoIMeW91cmdvbHMuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIB
+BAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUAO1N3dT4tuYBOizBbBv5AO2fYT8P0x70A
+DS1yb+H61BcAAAGNcRPt8gAABAMARjBEAiAMpD5lfh43xD1tAvsSa20OQ4LsQ8Kt
+YBvl5svUTuGrHAIgPveMh3yZ6z+QLW1k8Lv7z1kyXsxSvCUQrX16k7m1V8kAdwCi
+4r/WHt4vLweg1k5tN6fcZUOwxrUuotq3iviabfUX2AAAAY1xE+3xAAAEAwBIMEYC
+IQD+hmWzWe0y9M8xYKvuhySnHN6AWKQpvJgTqBsCFiiy5QIhANM0ce+SEC4BlY8m
+QAIGNXbAjlKU28q66EcTuSjji227MA0GCSqGSIb3DQEBCwUAA4IBAQAAfH8lbwUk
+JD6voPBGCTt7XSZPl9dq4LdmOLV3bsfjtqWOeGNCznBYKfRZO/UJ/srekCjapzKy
+DAmv0dl/tvBGfqhU/emOtKsq9AE0J7RqzF9SQPrVzq/VxWXGCCmtxUHEAlNk/lrg
+PqxpTUZdLpeBEbNvtloSaUEpe8mkFcFhw7TZVtdkpn+pHRlltqXry/8BekFPQR5Y
+qgI8akm2rXOV616MnF81DhIUVY4n6t4SVsDjSk69iDnKG97PJJK5yqsEfdZFiDRK
+PlhHTYwOsypaP/JMuanK8eGjnNR9pA40DEjAJO0kvE3IE7dHD3R1iGkXjr7wIkKw
+5NjP9yOv01mH
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
+WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
+R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
+sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
+NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
+Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
+/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
+AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
+Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
+FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
+AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
+Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
+gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
+PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
+ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
+CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
+lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
+avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
+yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
+yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
+hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
+HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
+MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
+nLRbwHOoq7hHwg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
+MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
+DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
+ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
+wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
+LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
+4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
+bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
+sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
+Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
+FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
+SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
+PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
+TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
+c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
++tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
+ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
+b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
+U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
+MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
+5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
+9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
+WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
+he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
+Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
+-----END CERTIFICATE-----

nginx/nginx-prod/allinvest/privkey.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDRQkqgMs0ldQRx
+UqisR9xrixFUYMVAAQIb3ni1jkybd8aykzYXYGj+Hw/AmReb5oBasTP2ZOJos2fR
+REHip65pYQC+uNzmhkU1cDdRXwRH76/309wEA9B0AeeTkrFEXkhVJ8k/b0dnL/q/
+3+hFO/FMP7L70w+zNL2P7kXznNqlr/iOnRrKEt9og0JrGJTiuByll5nwU7hkgiSn
+HnNZ74noV16xhT+GCWt4LOkc1k7Rl8RoCNJRvTt+ukbM5CmSlSSAoQR/mFlfSidY
+c4JkVpUSYLOLdeDDtg8cOTLtRtPFm2hEBrxO0YHAQjWPLFdStQcfzzVD0bEj0+qy
+LF9zIUOLAgMBAAECggEANWFhxAfxiRKWtYnOeVRDiDOLkii1aKRZM17HEBlitW4S
+g89FxyTS47BsxkbHXP+p0njNtpb5opfRbfKpk/YOaddS51QlFbE+ymj704gXgXpF
+O0USJPwMGuu5dU3AZp5eeUqS7dmnL01v+65UhATMgxTkxZSLtr1HdgXkVka3B/ir
+Q/iqR4ftt+qT0a9mzXQOxgdN7qnNwVNO1uJi87C6fQBRB6F724U5SJyOTMl9R6ZS
++JZ9Oz5xxoGLA/Nftn078uMjf2ymWfOqicHYeXxfPYllXNuRsIf7NA00F0orwF15
+TWBZLB5GbkOIP7k7vzabZMCbGmf42XYtt1oFYIssIQKBgQD7aB8cUDVdE47VOX4p
++Bf2ilMJA2d+KsCA3uYw5VQjjxBbfN+nChOx6e6eSmy2MMtH2ECG2IgW04FDbHtZ
+y2tbmRY3XIl+4dos+6ybbiYeYKRcHOQiXbjFK9ml1NpDcuLMHE3a6v0gFB8N0iB4
+J3u6h9+kHe3LGPzIVDGbITWi4wKBgQDVFQleHfRWM9/hebU8/tshY4sRJ9nA9haI
+F/NDMHhE+IyX9JHxGXtVE0ihOh0+0PLKLwtOepc4vqZaquKVnzZ82+sc+C4Iqg8K
+S+1NoRFOZG1AlM53UI51ZXLvXZp8gAdDBXzwBZpWZNdhJHJSnuwVI+UoDkrAQkmn
+/n4jzV01OQKBgQCH8pr4JYtlxIC1XryRl13l7JDQS+339MhaJ66UfD5OaDtxLYqH
+elSCHbzyDc7RinsyY4cpJAgbR84blprxSKXKR3MTBtA3M4xWTNXeyuaEAMCAKwNW
+bhXPUVIFcZ+BX6uysg+LtQyh/x93ysvSDY/Do1vVFHYVIHL5JUYZ3BBz/wKBgQDT
+oCYCnJtr9e9Xn6oZ30BBg/y9WCfTllVAaxEGXSBF19jCnntHyjgMga9zuSUMmzdX
+CKwhEG4aRHcxu2B4m3zhOwXiarZFkqiHYGtZ2ys2AVXkeyYnqBEklVI2W2+wUPNl
+ZBD2zYnAXjzu1OTaG857HIBebPtewTcoKwCajD8TOQKBgQDr07j3sx5nQsg4kHmR
+kBvHHjq7kQ1pEItrD/CfLsZ7Ntip4L82UzdZm/hhdM/12fB+wLu8HcZzvY5H1J+3
+IlkKYhAAe8lgzE7hYupVD9QtdFBuNsAnQfT+VV4JnZNDVZHXfnhz19KJ+iIvqton
+8WCEnmpiIKyt+Lq+Ol3n7PDMIw==
+-----END PRIVATE KEY-----

nginx/nginx-prod/config/nginx.conf

@@ -1,24 +0,0 @@
-events {}
-
-http {
-    client_max_body_size 50m;
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        '' close;
-    }
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
-    
-    include ./hosts.conf;
-}

nginx/nginx-prod/fullchain.pem

@@ -0,0 +1,58 @@
+-----BEGIN CERTIFICATE-----
+MIIE7TCCA9WgAwIBAgISBDL/ZyXlpK88JpU+aNYTYbZcMA0GCSqGSIb3DQEBCwUA
+MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
+EwNSMTAwHhcNMjQwODE4MTczMDAxWhcNMjQxMTE2MTczMDAwWjAZMRcwFQYDVQQD
+DA4qLnNwcmludGh1Yi5ydTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AKwZZehw3dlvH5AvVfnaybqjB5K3YixMDkE3ygHvPL1d7c3QzmuIsPkpSQOt+fEY
+ERQEcXype1tmT6jmZs+WdP8ASXDW7V8pHrYBffZ5Hoxc6vydr/ArZJWblfm+bYaA
+68ZRj9sv1cGK0dk34v4QYa8EqQRezxFRT0lvfB2vyfZ/4xQ/ZPDzVjivUcWoWrC5
++4WTg6e4ZtKQXiXBHS1z/FGhmTbudXXU9zi2Hyq+eEPwtU7hIZLtyAzc2TWJVHfw
+YJQMlSklpOMvKDSbgEW6LNsQcwYFJ/1MvX3C7TZX/uNuwssi5cMKmhecDf7g5pK4
+EqJnNFYZ9lZ0ofNFSj6qVu0CAwEAAaOCAhMwggIPMA4GA1UdDwEB/wQEAwIFoDAd
+BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
+HQ4EFgQU9g2CK2s4AK0F9lDh/iDOAgl9GJQwHwYDVR0jBBgwFoAUu7zDR6XkvKnG
+w6RyDBCNojXhyOgwVwYIKwYBBQUHAQEESzBJMCIGCCsGAQUFBzABhhZodHRwOi8v
+cjEwLm8ubGVuY3Iub3JnMCMGCCsGAQUFBzAChhdodHRwOi8vcjEwLmkubGVuY3Iu
+b3JnLzAZBgNVHREEEjAQgg4qLnNwcmludGh1Yi5ydTATBgNVHSAEDDAKMAgGBmeB
+DAECATCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AD8XS0/XIkdYlB1lHIS+DRLt
+kDd/H4Vq68G/KIXs+GRuAAABkWa/gHgAAAQDAEcwRQIhAOSEdIX9kjdYohZb942J
+dk5pUAYQl68bIBwIvHQF6Ru1AiAzNtoqdj11Uy4+lr0TbU8SE2tBgTGDxZRksCpC
+Kt83wQB3AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0AAABkWa/iHcA
+AAQDAEgwRgIhAPzli2g23TY0uFoU6LMrlqe3CPBWC8BWq/rnfOm/cOaJAiEAoefO
+g0i2LU8pUqkurW34EfXEQQUqSjy3ze8c9FKPUnYwDQYJKoZIhvcNAQELBQADggEB
+AMUvd2yvRsrp4iZk9rTd87Zjv0nWkAunwirx1jNhzRvP/vKGh1Zn1GPohr7TQQZ5
+EkJK+4w1+uq5ZrDrI3t+SKx15sv4iAJu7EAh6z0/oGkb27LlduXVSQ4hs5o/E4cL
+wdRONWKrKIchcM9vblicKOxFxCKUOXPMxH8YSDkkWK8KhCvE1sSzm0DzeRQVOwuK
+aWMJXoEF0pY6lOVGiGIxtozY3Q5IooBDX+bwDEq/SkwY38yig2NszpTwJKmVIV+E
+DjBoRHWoYYtEL1y2rh/OonQBGxSCUYSIrG3+BdqWwLL9LmgZk+A2X5Qa09aZQvnc
+hsfvAxxU+C7lArtjpA/pWYk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP
+MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
+Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa
+Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF
+bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL
+YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a
+/6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4
+FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR
+mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3
+DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG
+MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/
+AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5
+tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG
+Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD
+VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B
+AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo
+zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd
+u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9
+1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0
+GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh
+1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ
+QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N
+4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz
+rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei
+RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx
+KPpdzvvtTnOPlC7SQZSYmdunr3Bf9b77AiC/ZidstK36dRILKz7OA54=
+-----END CERTIFICATE-----

nginx/nginx-prod/nginx-prod.conf

@@ -0,0 +1,217 @@
+events {}
+
+http {
+    client_max_body_size 150m;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    server {
+        listen 80;
+        server_name gitlab.sprinthub.ru;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:1234/;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name gitlab.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:1234/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name swarmpit.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:888/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name portainer.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:8888/;
+        }
+
+        location /api/websocket/ {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name rabbitmq.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:15672/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name swarmpit.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:15672/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name minio.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:9001/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name gitea.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:3000/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name ~^(?<domain>.*)\.sprinthub\.ru$;
+
+        resolver 127.0.0.11 ipv6=off;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        proxy_set_header        X-Real-IP       $remote_addr;
+        location / {
+            proxy_pass http://$domain-nginx:1238$request_uri;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name yourgols.com;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name yourgols.com;
+
+        resolver 127.0.0.11 ipv6=off;
+
+        ssl_certificate     /etc/allinvest/fullchain.pem;
+        ssl_certificate_key /etc/allinvest/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+        proxy_set_header        X-Real-IP       $remote_addr;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        location / {
+            proxy_pass http://yourgols-nginx:1238$request_uri;
+        }
+    }
+
+}

nginx/nginx-prod/prepare.py

@@ -1,85 +0,0 @@
-import os
-import sys
-from minio import Minio
-from urllib.request import urlopen
-from json import loads
-
-
-minio_client = Minio(
-    "minio.sprinthub.ru:9000",
-    access_key="serviceminioadmin",
-    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
-)
-
-
-def get(url):
-    with urlopen(url) as response:
-        data = response.read().decode("utf-8")
-        return loads(data)
-
-
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
-
-config = ""
-for host, params in hosts.items():
-    config += """
-        server {{
-            listen      443 ssl http2;
-            listen      [::]:443 ssl http2;
-            server_name {host};
-
-            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
-            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
-
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            location / {{
-                resolver 127.0.0.11;
-                proxy_pass http://{target_host}:{port}$request_uri;
-            }}
-        }}\n\n
-    """.format(
-        host=host, target_host=params["host"], port=params["port"]
-    )
-    try:
-        fullchain = minio_client.get_object(
-            "certupdater", f"certificates/{host}/fullchain.pem"
-        )
-        privkey = minio_client.get_object(
-            "certupdater", f"certificates/{host}/privkey.pem"
-        )
-        try:
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
-
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
-            fp.write(fullchain.data)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-            fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
-
-try:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
-        fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)

nginx/nginx-prod/privkey.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCsGWXocN3Zbx+Q
+L1X52sm6oweSt2IsTA5BN8oB7zy9Xe3N0M5riLD5KUkDrfnxGBEUBHF8qXtbZk+o
+5mbPlnT/AElw1u1fKR62AX32eR6MXOr8na/wK2SVm5X5vm2GgOvGUY/bL9XBitHZ
+N+L+EGGvBKkEXs8RUU9Jb3wdr8n2f+MUP2Tw81Y4r1HFqFqwufuFk4OnuGbSkF4l
+wR0tc/xRoZk27nV11Pc4th8qvnhD8LVO4SGS7cgM3Nk1iVR38GCUDJUpJaTjLyg0
+m4BFuizbEHMGBSf9TL19wu02V/7jbsLLIuXDCpoXnA3+4OaSuBKiZzRWGfZWdKHz
+RUo+qlbtAgMBAAECggEAUfpfMtPguZxXWqVRvQzdHwxdpSO5ngQ0nhhnH3jIZCQE
+DRAz48FfG7Dw2NHcx12BdRmQvaM14ZngxEHMI4I2BOosEZYvyC6cNHKNgAS96nqw
+bNjoX+0roqBUVnzBS1rJ9NQRRIWKuwDXaTNX61H+VhJQOIa4+DTVIdP7OWDtQX9t
+DyQM/vvGM0gHmUKvd15n8iU5obxMZm+2ntUYe38dSCKANuVgmT/+/mJHt7SWYXuD
+PAQX5IWVK2sMT+snPTW7ERXwOwHn4Sl57Juqz4lOGKYAsveFqi0F1UNyQ61ggjXU
+I17bSHONBxK1MPYKQyjiVGvMylpyTd0RWAUSUs3yQQKBgQDkKuKG+4ndxkxIpe/6
+ENkP2cvlhkO2BdQKfYsw20pxIZqOVwlatZ0OlFMkFJFWhIRP+aYi0+69THOpV1Dk
+E33+438fxBJLAZXUY5PJs47JBLq/bUCWgblshe3QAW3gZLbDb3+i0CI7YA7b6Vo4
+Rf0mkyjo10VmpjK9x7hvbtMfCQKBgQDBF6L+5jwlOHUV8FHRO2AlrRUMNHcEt3JN
+JDgoxPidHq1gYHsDC+tp2C+x1z5zSruOfIQPt0JnED+H+0l8gnPKMFbdrgJBExGq
+4z0FQIqysVE+8kPh6ikOMrec6RSHsW1e+y0v1Mn7zHb4a+6JfIukjsqPm07wSWFe
+9DXlGKANxQKBgQCok/rcalq5Tbqs7lU4+Fu3t15LjgDXKsU4nvtJNKxym7ZatnnF
+2GtbC0HGZZ/gQXaUtEoIb3dzy1mlY0rzyGcN/L2/FZnCa0BtNMlLfGvhn6nup2TS
+DrSWNvm29mddJGxYRzgRbh/sqJMx7d5nt2ZLquzN48d2CRNyXm6pfkNkKQKBgAur
+mw1e6vmw7NqzmK5VsVz1lhUTwrHFSKJC8yX7qa8NYJs3mZe4i7Ts/Qz5nmunc6iL
+/AtbHydNgxl75Zgh5k+tFkL1tmsqdOHoNBLyMK/WKbvtNo8b8PlLtW9FYxlEbwDT
+m4qNiNuwIuym0Vb78RC0FKgTUfUR6lGr3uoGz/2lAoGBANQrHCOr+2eOZawiWlQ3
+jPJQVRwzpPHPGnElcGJBMcA03UQCO/HXSJl/V5OGZjVH4zZ3iRInYvq4NR+KeQC8
+VXU4AWS9QIyx7UAGO8eDzENz6JG4Q1txkPsGIipvROdCCWFqaudyxRuWnKsXEwYn
+RGyseajshyNkpwLoMk2gx67+
+-----END PRIVATE KEY-----

nginx/nginx-prod/refre.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-nginx -s reload

nginx/nginx-prod/run.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-/docker-entrypoint.sh nginx -g 'daemon off;'

prepare/run-development.sh

@@ -1,11 +0,0 @@
-docker login -u mathwave -p $DOCKERHUB_PASSWORD
-mkdir /sprint-data/mongo || true
-mkdir /sprint-data/redis || true
-mkdir /sprint-data/rabbitmq || true
-mkdir /sprint-data/certs || true
-mkdir /sprint-data/gitea || true
-mkdir /sprint-data/clickhouse || true
-chmod 777 /sprint-data/redis
-chmod 777 /sprint-data/rabbitmq
-chmod 777 /sprint-data/gitea
-chmod 777 /sprint-data/clickhouse

prepare/run-production.sh

@@ -1,29 +0,0 @@
-docker login -u mathwave -p $DOCKERHUB_PASSWORD
-docker network create -d overlay --attachable swarmpit-nginx || true
-docker network create -d overlay --attachable common-infra-nginx || true
-docker network create -d overlay --attachable common-infra-nginx-development || true
-docker network create -d overlay --attachable queues || true
-docker network create -d overlay --attachable queues-development || true
-docker network create -d overlay --attachable configurator || true
-docker network create -d overlay --attachable monitoring || true
-docker network create -d overlay --attachable configurator-development || true
-docker network create -d overlay --attachable clickhouse || true
-docker network create -d overlay --attachable clickhouse-development || true
-mkdir /sprint-data/mongo || true
-mkdir /sprint-data/redis || true
-mkdir /sprint-data/rabbitmq || true
-mkdir /sprint-data/certs || true
-mkdir /sprint-data/gitea || true
-mkdir /sprint-data/clickhouse || true
-mkdir /sprint-data/grafana || true
-mkdir /sprint-data/authelia || true
-mkdir /sprint-data/authelia/config || true
-mkdir /sprint-data/authelia/data || true
-chmod 777 /sprint-data/authelia
-chmod 777 /sprint-data/authelia/config
-chmod 777 /sprint-data/authelia/data
-chmod 777 /sprint-data/redis
-chmod 777 /sprint-data/rabbitmq
-chmod 777 /sprint-data/gitea
-chmod 777 /sprint-data/clickhouse
-chmod 777 /sprint-data/grafana